How about setting up a passcode as the only means to unlock & have face/fingerprint recognition as triggers to do the same thing as the duress code. Make it appear face/fingerprint ID is functional on the device so that when CPB tries to use it without consent THEY are 100% to blame for the wipe.
